Hi,
Not sure I completely followed your post so take my comments with a grain of salt.
We map from Mac to NTFS file shares on a Windows Server. We use DFS and Access Based Enumeration on the file server(s).
We found Mac users needed Read permission at every level of the Windows server folder path from root to destination. We could set the mapping to a deeper level shared folder but the user would not see it unless they had permission to "traverse" the entire path.
In relation to your comment about SaveAs, I can make an argument that you need the traverse permissons and one that maybe you don't need them so not sure this helps. Especially if this is not a brand new implementation for you as it was when we discovered this...
I had had trouble writing a script that maps the network drives so would be interested in your solution if you are willing to share. We use the setting to follow the AD Home path which works fine for us but could use a better solution for mapping other shares.
On some machines we run into what I think is a Catch22 with the DFS target because it contains our domain as part of the path and sometimes the Macs try to map to the AD netlogon and sysvol shares. It is as if a small sample of machines cannot resolve the full path to the share.
ex: dfs share path would be domaindfsshare
vs. the failure result which is just domain and the native AD shares under domain are netlogon and sysvol
